Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2024-678)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-678 advisory. The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that...

Amazon Linux 2023 : rapidjson-devel (ALAS2023-2024-684)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-684 advisory. Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the GenericReader::ParseNumber function of include/rapidjson/reader.h when parsing JSON text from a stream. An...

Amazon Linux 2023 : nerdctl (ALAS2023-2024-700)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-700 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...

Amazon Linux 2023 : mod_http2 (ALAS2023-2024-689)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-689 advisory. Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Tenable has...

Amazon Linux 2023 : python3-setuptools, python3-setuptools-wheel (ALAS2023-2024-676)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-676 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-695)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-695 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASP...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2024-680)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-680 advisory. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname of any RTYPE can suffer from degraded performance as content is being added or update...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-683)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-683 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions CVE-2023-52884 In the Linux kernel, the following...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-696)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-696 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring: drop any code related to SCMRIGHTS CVE-2023-52656 In the Linux kernel, the following vulnerability has been resolved...

Amazon Linux 2023 : gtk3, gtk3-devel, gtk3-immodule-xim (ALAS2023-2024-675)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-675 advisory. gtk3: gtk2: Library injection from CWD CVE-2024-6655 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this...

Amazon Linux 2023 : squid (ALAS2023-2024-687)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-687 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This erro...

Amazon Linux 2023 : docker (ALAS2023-2024-674)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-674 advisory. 2024-08-28: CVE-2024-29018 was added to this advisory. 2024-08-28: CVE-2024-24786 was added to this advisory. The protojson.Unmarshal function can enter an infinite loop when unmarshaling certa...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2024-668)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-668 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-665)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-665 advisory. 2024-08-14: CVE-2024-42063 was added to this advisory. 2024-08-14: CVE-2024-41009 was added to this advisory. 2024-08-14: CVE-2024-42070 was added to this advisory. 2024-08-14: CVE-2024-42096 w...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2024-670)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-670 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2024-663)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-663 advisory. In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30204 In Emacs befor...

Amazon Linux 2023 : composer (ALAS2023-2024-659)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-659 advisory. Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names c...

Amazon Linux 2023 : default-editor, nano, nano-default-editor (ALAS2023-2024-652)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-652 advisory. nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file CVE-2024-5742 Tenable has extracted the preceding...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2024-660)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-660 advisory. OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointi...

Medium: wget

Issue Overview: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. CVE-2024-38428 Affected...